Skip to content

Commit ec5cf46

Browse files
MHaggisMHaggis
committed
The Haag Identity: Operation Seashell Blizzard 🌊❄️
This PR introduces comprehensive updates to our detection analytics, focusing on tagging relevant detections with the new "Seashell Blizzard" analytic story. The changes include: Version and date updates across 20 detection files, with dates standardized to '2025-03-24' or '2025-03-25', and version numbers incremented appropriately. Analytics tagged with "Seashell Blizzard" include: ConnectWise ScreenConnect vulnerability detections (authentication bypass, path traversal) Exchange Server exploitation detections (ProxyShell, ProxyNotShell, web shell) Credential access monitoring (LSASS dumps via TaskMgr and ProcDump) Remote access software usage detections (file, process, registry) Scheduled task abuse detections SQL Server xp_cmdshell configuration changes Registry hive dumping detection Key updates: - Added "Seashell Blizzard" tag to 20 existing detections These changes enhance our ability to track and detect activities associated with the Seashell Blizzard threat actor.
1 parent 4583864 commit ec5cf46

20 files changed

+80
-39
lines changed

‎detections/endpoint/connectwise_screenconnect_path_traversal.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ConnectWise ScreenConnect Path Traversal
22
id: 56a3ac65-e747-41f7-b014-dff7423c1dda
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-03-24'
55
author: Michael Haag, Splunk
66
data_source:
77
- Sysmon EventID 11
@@ -59,6 +59,7 @@ rba:
5959
tags:
6060
analytic_story:
6161
- ConnectWise ScreenConnect Vulnerabilities
62+
- Seashell Blizzard
6263
asset_type: Endpoint
6364
mitre_attack_id:
6465
- T1190

‎detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ConnectWise ScreenConnect Path Traversal Windows SACL
22
id: 4e127857-1fc9-4c95-9d69-ba24c91d52d7
3-
version: 5
4-
date: '2024-12-10'
3+
version: 6
4+
date: '2025-03-24'
55
author: Michael Haag, Splunk
66
data_source:
77
- Windows Event Log Security 4663
@@ -57,6 +57,7 @@ tags:
5757
analytic_story:
5858
- ConnectWise ScreenConnect Vulnerabilities
5959
- Compromised Windows Host
60+
- Seashell Blizzard
6061
asset_type: Endpoint
6162
mitre_attack_id:
6263
- T1190

‎detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Creation of lsass Dump with Taskmgr
22
id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
3-
version: 5
4-
date: '2025-02-10'
3+
version: 7
4+
date: '2025-03-25'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -56,6 +56,7 @@ tags:
5656
analytic_story:
5757
- Credential Dumping
5858
- CISA AA22-257A
59+
- Seashell Blizzard
5960
asset_type: Windows
6061
mitre_attack_id:
6162
- T1003.001

‎detections/endpoint/detect_exchange_web_shell.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Exchange Web Shell
22
id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
3-
version: 10
4-
date: '2025-02-10'
3+
version: 11
4+
date: '2025-03-25'
55
author: Michael Haag, Shannon Davis, David Dorsey, Splunk
66
status: production
77
type: TTP
@@ -74,6 +74,7 @@ tags:
7474
- ProxyShell
7575
- Compromised Windows Host
7676
- BlackByte Ransomware
77+
- Seashell Blizzard
7778
asset_type: Endpoint
7879
mitre_attack_id:
7980
- T1133

‎detections/endpoint/detect_psexec_with_accepteula_flag.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect PsExec With accepteula Flag
22
id: 27c3a83d-cada-47c6-9042-67baf19d2574
3-
version: 10
4-
date: '2025-02-10'
3+
version: 11
4+
date: '2025-03-25'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: TTP
@@ -81,6 +81,7 @@ tags:
8181
- BlackByte Ransomware
8282
- DarkGate Malware
8383
- Rhysida Ransomware
84+
- Seashell Blizzard
8485
asset_type: Endpoint
8586
mitre_attack_id:
8687
- T1021.002

‎detections/endpoint/detect_remote_access_software_usage_file.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage File
22
id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
3-
version: 6
4-
date: '2024-11-13'
3+
version: 7
4+
date: '2025-03-24'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -81,6 +81,7 @@ tags:
8181
- Gozi Malware
8282
- CISA AA24-241A
8383
- Remote Monitoring and Management Software
84+
- Seashell Blizzard
8485
asset_type: Endpoint
8586
mitre_attack_id:
8687
- T1219

‎detections/endpoint/detect_remote_access_software_usage_fileinfo.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage FileInfo
22
id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454
3-
version: 6
4-
date: '2024-11-13'
3+
version: 7
4+
date: '2025-03-24'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -73,6 +73,7 @@ tags:
7373
- Ransomware
7474
- Gozi Malware
7575
- Remote Monitoring and Management Software
76+
- Seashell Blizzard
7677
asset_type: Endpoint
7778
mitre_attack_id:
7879
- T1219

‎detections/endpoint/detect_remote_access_software_usage_process.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage Process
22
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
3-
version: 6
4-
date: '2024-11-13'
3+
version: 7
4+
date: '2025-03-24'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -86,6 +86,7 @@ tags:
8686
- Gozi Malware
8787
- CISA AA24-241A
8888
- Remote Monitoring and Management Software
89+
- Seashell Blizzard
8990
asset_type: Endpoint
9091
mitre_attack_id:
9192
- T1219

‎detections/endpoint/detect_remote_access_software_usage_registry.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage Registry
22
id: 33804986-25dd-43cf-bb6b-dc14956c7cbc
3-
version: 3
4-
date: '2025-01-10'
3+
version: 5
4+
date: '2025-03-24'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -61,6 +61,7 @@ tags:
6161
- Gozi Malware
6262
- CISA AA24-241A
6363
- Remote Monitoring and Management Software
64+
- Seashell Blizzard
6465
asset_type: Endpoint
6566
mitre_attack_id:
6667
- T1219

‎detections/endpoint/dump_lsass_via_procdump.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Dump LSASS via procdump
22
id: 3742ebfe-64c2-11eb-ae93-0242ac130002
3-
version: 10
4-
date: '2025-02-10'
3+
version: 11
4+
date: '2025-03-25'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -73,6 +73,7 @@ tags:
7373
- HAFNIUM Group
7474
- Compromised Windows Host
7575
- Credential Dumping
76+
- Seashell Blizzard
7677
asset_type: Endpoint
7778
mitre_attack_id:
7879
- T1003.001

‎detections/endpoint/exchange_powershell_abuse_via_ssrf.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Exchange PowerShell Abuse via SSRF
22
id: 29228ab4-0762-11ec-94aa-acde48001122
3-
version: 6
4-
date: '2025-02-19'
3+
version: 7
4+
date: '2025-03-25'
55
author: Michael Haag, Splunk
66
status: experimental
77
type: TTP
@@ -39,6 +39,7 @@ tags:
3939
- ProxyShell
4040
- BlackByte Ransomware
4141
- ProxyNotShell
42+
- Seashell Blizzard
4243
asset_type: Endpoint
4344
mitre_attack_id:
4445
- T1190

‎detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Scheduled Task Initiation on Remote Endpoint
22
id: 95cf4608-4302-11ec-8194-3e22fbd008af
3-
version: 7
4-
date: '2025-02-10'
3+
version: 8
4+
date: '2025-03-24'
55
author: Mauricio Velazco, Splunk, Badoodish, Github Community
66
status: production
77
type: TTP
@@ -62,6 +62,7 @@ tags:
6262
- Active Directory Lateral Movement
6363
- Living Off The Land
6464
- Scheduled Tasks
65+
- Seashell Blizzard
6566
asset_type: Endpoint
6667
mitre_attack_id:
6768
- T1053.005

‎detections/endpoint/windows_scheduled_task_with_suspicious_command.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Scheduled Task with Suspicious Command
22
id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3
3-
version: 1
4-
date: '2025-02-07'
3+
version: 2
4+
date: '2025-03-24'
55
author: Steven Dick
66
status: production
77
type: TTP
@@ -59,6 +59,7 @@ tags:
5959
- Windows Persistence Techniques
6060
- Ransomware
6161
- Ryuk Ransomware
62+
- Seashell Blizzard
6263
asset_type: Endpoint
6364
mitre_attack_id:
6465
- T1053.005

‎detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Sensitive Registry Hive Dump Via CommandLine
22
id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e
3-
version: 3
4-
date: '2025-02-10'
3+
version: 4
4+
date: '2025-03-24'
55
author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk
66
status: production
77
type: TTP
@@ -78,6 +78,7 @@ tags:
7878
- Industroyer2
7979
- Volt Typhoon
8080
- Windows Registry Abuse
81+
- Seashell Blizzard
8182
asset_type: Endpoint
8283
mitre_attack_id:
8384
- T1003.002

‎detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows SQL Server xp_cmdshell Config Change
22
id: 5eb76fe2-a869-4865-8c4c-8cff424b18b1
3-
version: 1
4-
date: '2025-02-04'
3+
version: 3
4+
date: '2025-03-24'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -64,6 +64,7 @@ rba:
6464
tags:
6565
analytic_story:
6666
- SQL Server Abuse
67+
- Seashell Blizzard
6768
asset_type: Windows
6869
mitre_attack_id:
6970
- T1505.001

‎detections/web/connectwise_screenconnect_authentication_bypass.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ConnectWise ScreenConnect Authentication Bypass
22
id: d3f7a803-e802-448b-8eb2-e796b223bfff
3-
version: 5
4-
date: '2024-11-15'
3+
version: 6
4+
date: '2025-03-24'
55
author: Michael Haag, Splunk
66
data_source:
77
- Suricata
@@ -61,6 +61,7 @@ rba:
6161
tags:
6262
analytic_story:
6363
- ConnectWise ScreenConnect Vulnerabilities
64+
- Seashell Blizzard
6465
asset_type: Web Server
6566
mitre_attack_id:
6667
- T1190

‎detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Nginx ConnectWise ScreenConnect Authentication Bypass
22
id: b3f7a803-e802-448b-8eb2-e796b223bccc
3-
version: 4
4-
date: '2024-11-15'
3+
version: 5
4+
date: '2025-03-24'
55
author: Michael Haag, Splunk
66
data_source:
77
- Nginx Access
@@ -60,6 +60,7 @@ rba:
6060
tags:
6161
analytic_story:
6262
- ConnectWise ScreenConnect Vulnerabilities
63+
- Seashell Blizzard
6364
asset_type: Web Proxy
6465
mitre_attack_id:
6566
- T1190

‎detections/web/proxyshell_proxynotshell_behavior_detected.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ProxyShell ProxyNotShell Behavior Detected
22
id: c32fab32-6aaf-492d-bfaf-acbed8e50cdf
3-
version: 4
4-
date: '2024-11-15'
3+
version: 5
4+
date: '2025-03-24'
55
author: Michael Haag, Splunk
66
status: production
77
type: Correlation
@@ -55,8 +55,8 @@ drilldown_searches:
5555
tags:
5656
analytic_story:
5757
- ProxyShell
58-
- BlackByte Ransomware
5958
- ProxyNotShell
59+
- Seashell Blizzard
6060
asset_type: Web Server
6161
mitre_attack_id:
6262
- T1190

‎detections/web/windows_exchange_autodiscover_ssrf_abuse.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Exchange Autodiscover SSRF Abuse
22
id: d436f9e7-0ee7-4a47-864b-6dea2c4e2752
3-
version: 4
4-
date: '2025-01-16'
3+
version: 5
4+
date: '2025-03-24'
55
author: Michael Haag, Nathaniel Stearns, Splunk
66
status: production
77
type: TTP
@@ -59,6 +59,7 @@ tags:
5959
- ProxyShell
6060
- BlackByte Ransomware
6161
- ProxyNotShell
62+
- Seashell Blizzard
6263
asset_type: Web Server
6364
cve:
6465
- CVE-2021-34523

‎stories/seashell_blizzard.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Seashell Blizzard
2+
id: 72d9b847-0600-4cb6-8f70-516cc662a55c
3+
version: 1
4+
status: production
5+
date: '2025-03-24'
6+
author: Michael Haag, Splunk
7+
description: Seashell Blizzard is a threat actor known for targeting organizations globally through a sophisticated campaign leveraging Exchange Server vulnerabilities, custom tools, and living-off-the-land techniques for persistent access and data collection.
8+
narrative: Seashell Blizzard operates through a multi-stage attack chain that begins with Exchange Server exploitation and progresses to establishing persistent access through various techniques. The group's initial access typically involves the exploitation of Exchange Server vulnerabilities including ProxyShell and ProxyNotShell, followed by web shell deployment through compromised Exchange paths and credential harvesting using renamed system tools and Task Manager UI.
9+
The threat actor maintains persistence by deploying scheduled tasks, installing OpenSSH with custom keys, and making registry modifications for automatic execution. Their command and control infrastructure leverages Tor hidden services (ShadowLink) alongside legitimate remote access tools and custom tunneling utilities for covert communications.
10+
For lateral movement and data collection, Seashell Blizzard extensively abuses Exchange PowerShell for mailbox access while conducting NTLM credential theft and systematic enumeration of network resources. The group demonstrates sophisticated operational security, often using legitimate system tools and living-off-the-land binaries to blend in with normal system operations. Their focus appears to be on long-term persistence and data collection, with particular emphasis on email data and network credentials.
11+
Detection strategies focus on identifying suspicious Exchange Server activity, monitoring for unusual PowerShell commands, tracking scheduled task creation, and identifying anomalous system tool usage in sensitive contexts. The group's ability to maintain long-term access while evading detection makes them a significant threat to organizations globally.
12+
references:
13+
- https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/
14+
- https://edgewaterit.com/2025/02/20/seashell-blizzard-apt/
15+
tags:
16+
category:
17+
- Adversary Tactics
18+
product:
19+
- Splunk Enterprise
20+
- Splunk Enterprise Security
21+
- Splunk Cloud
22+
usecase: Advanced Threat Detection
23+
cve: []

0 commit comments

Comments
 (0)